A critical React RSC RCE flaw, GHSA-xqc2-xf4c-x3h3, carries no CVE id. React fixed it on 14 October 2026 in react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel. Update to 19.0.9, 19.1.10, 19.2.9 or 19.3.1, whichever line your app tracks, as soon as you confirm the version.
Why React RSC RCE Has No CVE Id
GitHub’s global advisory database had no entry for GHSA-xqc2-xf4c-x3h3 on 8 Nov 2026. Tools that read that database will not flag it, because the advisory has no CVE identifier at all. Each fixed release’s own notes say only “Improve transport protocol,” with no mention of security.
Our page on GHSA-xqc2-xf4c-x3h3 covers the advisory in full, including the same-day denial-of-service sibling GHSA-h3gv-c5rc-p453. There is no public report of exploitation in the wild found as of 8 Nov 2026.
Fixed Versions for React and Next.js
Next.js carries its own advisory, GHSA-673q-mjm6-r5xr. Both it and GHSA-xqc2-xf4c-x3h3 describe responses carrying multiple typed arrays and were published the same day, 14 October 2026; GHSA-673q is fixed in 16.4.1. On 3 November 2026 Vercel shipped seven more moderate advisories in 16.4.5 and 15.5.29. No source states that the Next 15 line carries the GHSA-xqc2-xf4c-x3h3 fix, so 15.5.29 is the current security release to target, not a confirmed fix for this specific flaw.
Vercel’s 3 November 2026 release also carried seven moderate advisories: CVE-2026-119346 through CVE-2026-119351, plus CVE-2026-119790. Between them they cover a cookie leak on Edge routes, an SVG rejection bypass, a response-injection path and four separate cache poisoning or disclosure issues in use cache. None of the seven reaches the critical rating of GHSA-xqc2-xf4c-x3h3. All seven landed in 16.4.5; only three of them — the cookie leak, the SVG bypass and the response-injection advisory — also landed in 15.5.29.
- Check your lockfileSearch package-lock.json, yarn.lock or pnpm-lock.yaml for react-server-dom-webpack, react-server-dom-turbopack or react-server-dom-parcel, not just package.json.
- Compare the versionVersions 19.0.0 to 19.0.8, 19.1.0 to 19.1.9, 19.2.0 to 19.2.8 and 19.3.0 are affected.
- UpgradeMove to 19.0.9, 19.1.10, 19.2.9 or 19.3.1.
- Check your framework tooNext.js apps should move to 16.4.5 or 15.5.29, the current security releases, and still verify the react-server-dom version directly.
- Do not wait on your scannerA clean Dependabot or npm audit run does not mean this package is safe, since the advisory has no CVE id.
For the earlier, exploited React Server Components flaw, see our page on React2Shell (CVE-2025-55182). For the Next.js side, see our pages on the Next.js use cache RCE and the Next.js RCE patch check.